Privacy policy

Valid from: XXX. Version 1.

This policy explains what personal data we handle, why, how long we keep it, who receives it and what your rights are. It covers this website, the contact form, email and messages with us, and our work with clients.

The short version

• This website sets no cookies and uses no analytics, tracking or advertising tools.
• If you contact us, we use your details to answer you and, if you wish, to work with you.
• We keep enquiries that lead nowhere for 12 months after our last contact, then delete them.
• We do not sell your data and do not use it to make automated decisions about you.
• Some of our service providers are in the United States. Sections 5 and 6 name them.
• You can ask us to see, correct or delete your data at any time: info@oryvengroup.com.

1. Who is responsible for your data

The controller of your personal data is Adam Branný, a sole trader registered in the Czech Republic and trading as Oryven Group. Oryven Group is a trading name and not a registered company.

• Registered address: č.p. 1306, 739 95 Bystřice, Czech Republic
• Business ID (IČO): 29864381
• Registered in the Trade Register kept by: XXX
• Email for all privacy questions: info@oryvengroup.com

We have not appointed a data protection officer, because the law does not require one for a business of our size and activity.

Role of our partner: XXX

2. What we do with your data

2.1 When you visit this website

What: your IP address and the technical details your browser sends with every request, such as browser type, the page requested and the time. Our host, Cloudflare, handles this data so the page can reach you. We do not use it to identify you.

Why and legal basis: to deliver the website and protect it against attacks and misuse. This is our legitimate interest under Article 6(1)(f) GDPR in running a website that is secure and works.

How long: we do not keep this data ourselves. Cloudflare keeps technical logs only for as long as it needs them to provide and secure the service. Its published policy sets no fixed number of days.

2.2 When you use the contact form or write to us

What: your name, your business name if you give it, your email address, your message, and anything else you choose to send us, including attachments and your phone number if you call or message us. Please do not send us sensitive data, such as health information, that we do not need.

Why and legal basis: to answer you. If you ask about our services, we process your data to take steps you requested before a possible contract, under Article 6(1)(b) GDPR. For any other message, we rely on Article 6(1)(f) GDPR, our legitimate interest in answering people who contact us.

How long: if no work follows, we delete your messages 12 months after our last contact with you. If we agree to work together, section 2.4 applies. Copies of form messages stay in Resend's logs for up to 30 days after sending.

2.3 If we contacted you first

We sometimes contact businesses we believe could benefit from our services, for example with a short message offering a free demo.

What: business contact details, meaning the business name, the name of the owner or contact person if it is published, business phone number, business email address, website and social media pages, plus our own notes on whether we contacted you and what you replied.

Where we got it: public sources, such as Google Maps listings, your business website and your public social media pages.

Why and legal basis: to offer our services to businesses. This is our legitimate interest in promoting our business under Article 6(1)(f) GDPR.

How long: up to 12 months after our last contact. If you tell us not to contact you again, we stop immediately and keep only the minimum needed to make sure we respect that.

You can object at any time, for free and without giving a reason. Write to info@oryvengroup.com or simply reply to our message.

2.4 If you become a client

What: contact and billing details, contract documents, project communication and invoices.

Why and legal basis: to perform our contract with you, under Article 6(1)(b) GDPR, and to meet our tax and accounting duties, under Article 6(1)(c) GDPR.

How long: project communication for XXX years after the work ends, in case of questions or claims, which is our legitimate interest under Article 6(1)(f) GDPR. Invoices and tax records for XXX years, as Czech tax law requires.

2.5 Websites we build for other businesses

When we build or look after a website for a client, that client decides how its visitors' data is used and is responsible for it. We act only on the client's instructions, and that client's own privacy policy applies. If your question is about such a website, please contact that business first.

3. Cookies and tracking

This website sets no cookies and stores nothing on your device. It has no analytics, advertising pixels or social media plugins, and its fonts are loaded from our own site, not from Google. For this reason there is no cookie banner. If that ever changes, we will update this policy first and ask for your consent where the law requires it.

4. What happens if you do not give us your data

You are never legally required to give us your data. To answer you we need a way to reach you, so the contact form asks for your name, email and message. Your business name is optional. Without the required fields we cannot process your enquiry, and if you do not provide the details needed for a contract and invoice, we cannot work together.

5. Who receives your data

We do not sell your data or share it for anyone else's marketing. We use these service providers to run our business:

For clients, we also share what is legally required with our tax adviser or accountant, if we use one: XXX. We disclose data to public authorities, such as tax offices or courts, only where the law requires it. If we ever use another provider that receives your data, we will add it here.

6. Transfers outside the European Union

Cloudflare and Resend are based in the United States, and Resend stores data there. Google and WhatsApp may also process data there. These transfers are protected as follows:

• The European Commission decided on 10 July 2023 that the United States ensures adequate protection for companies certified under the EU-U.S. Data Privacy Framework. Cloudflare and Resend state that they are certified. You can check any company on the official list.
• Resend also uses the European Commission's Standard Contractual Clauses under Article 46(2)(c) GDPR, included in its data processing addendum. Cloudflare's data processing addendum provides for the same clauses if its certification ever ends.
• You can ask us for a copy of these safeguards at info@oryvengroup.com.

7. Your rights

You can use these rights for free by writing to info@oryvengroup.com. We reply within one month. We may ask you to confirm your identity first, so that we do not give your data to someone else.

• Access: ask whether we hold your data and get a copy.
• Correction: have wrong or incomplete data fixed.
• Deletion: have your data erased, unless the law requires us to keep it.
• Restriction: ask us to pause the use of your data, for example while we check a complaint.
• Objection: object to any processing based on our legitimate interests. If we contact you to promote our services, we will stop as soon as you object.
• Portability: receive data you gave us under a contract in a common electronic format, or have it sent to another provider where this is technically possible.

Where we rely on legitimate interests, you can ask us how we weighed our interests against yours and we will explain it.

8. Complaints

We would like to solve any problem with you directly, but you can complain to a data protection authority at any time, in particular where you live or work. In the Czech Republic this is the Úřad pro ochranu osobních údajů, Pplk. Sochora 727/27, 170 00 Praha 7, uoou.gov.cz, posta@uoou.gov.cz.

9. How we protect your data

The website and contact form use encrypted connections. Only the people who need your data to do their work can read it. Our accounts are protected by passwords and XXX. No system is perfectly secure, but if a breach puts your rights at risk, we will tell you and the authority as the law requires.

10. Automated decisions and children

We make no decisions about you based only on automated processing, and we do not profile you. Our services are for businesses and are not aimed at children.

11. If you are in Switzerland

We also work with businesses in Switzerland. If you are there, you have the rights given by the Swiss Federal Act on Data Protection in addition to those above, and you can contact the Federal Data Protection and Information Commissioner at edoeb.admin.ch.

12. Changes to this policy

If the way we handle your data changes, we will update this page and its date. If a change affects you in a significant way and we have your contact details, we will tell you directly before it applies.